CancelDll
LoadDll
Behavioral task
behavioral1
Sample
f5ddbb89e28df0b7d5f4b666a0656b30_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f5ddbb89e28df0b7d5f4b666a0656b30_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f5ddbb89e28df0b7d5f4b666a0656b30_JaffaCakes118
Size
64KB
MD5
f5ddbb89e28df0b7d5f4b666a0656b30
SHA1
8ef105f5e7e394f750f6f598316123649f728761
SHA256
19eb6c36f8b04b12b408ce80b2091a28b167b571908e0bf901ca65022901f16f
SHA512
42c9b3c75eb15434f4e1dbd68f298ca4a1be444a55185b3ba39a10cf03c069a3163f0b7a5c161a2a9be2cd5fd81df3e18f6f6d092bef4c5a616e0cfb3a955827
SSDEEP
1536:/lrQUgDVwbR2YaIt+PNHWLCbX2oMc/SdzxURSaW/Nd1p/wtu08Xyld:NrQUsVwsYH+5bm08meNfkr
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f5ddbb89e28df0b7d5f4b666a0656b30_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ